oski | 5d9e9eec843781fcd39a0dfe23f9b9b6468cbf23ca327e1acedf8567b612cd38

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28911267f7db0fbdec9a4efae56e4f35.exe
Size

248KB
MD5

28911267f7db0fbdec9a4efae56e4f35
SHA1

39ad01109f81e0177c8b88132e677dade0f998e1
SHA256

5d9e9eec843781fcd39a0dfe23f9b9b6468cbf23ca327e1acedf8567b612cd38
SHA512

7eb8916eb81b4866f73bb78f1f5651cd483fa46017f7f86e993d9fb882732c2f8e2878fe2c68ce3a75e364cf181f2da23f3904dfe9a58e08713d81731927844a
SSDEEP

6144:V7AFPOns551dxzAUdYKHWqLHWm00RLqp0axj3N:Vaj51ddxdq6NM2axTN

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

scarsa.ac.ug

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 3112	4884	28911267f7db0fbdec9a4efae56e4f35.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3812	3112	WerFault.exe	92

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4884	28911267f7db0fbdec9a4efae56e4f35.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	28911267f7db0fbdec9a4efae56e4f35.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3112	4884	28911267f7db0fbdec9a4efae56e4f35.exe	92
PID 4884 wrote to memory of 3112	4884	28911267f7db0fbdec9a4efae56e4f35.exe	92
PID 4884 wrote to memory of 3112	4884	28911267f7db0fbdec9a4efae56e4f35.exe	92
PID 4884 wrote to memory of 3112	4884	28911267f7db0fbdec9a4efae56e4f35.exe	92

C:\Users\Admin\AppData\Local\Temp\28911267f7db0fbdec9a4efae56e4f35.exe
"C:\Users\Admin\AppData\Local\Temp\28911267f7db0fbdec9a4efae56e4f35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\28911267f7db0fbdec9a4efae56e4f35.exe
  "C:\Users\Admin\AppData\Local\Temp\28911267f7db0fbdec9a4efae56e4f35.exe"
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 1304
    3⤵
    - Program crash
    PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3112 -ip 3112
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3112-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3112-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3112-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3112-10-0x0000000077502000-0x0000000077503000-memory.dmp

Filesize
4KB

Download
memory/3112-11-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3112-14-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3112-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-2-0x0000000077502000-0x0000000077503000-memory.dmp

Filesize
4KB

Download
memory/4884-3-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4884-4-0x0000000000650000-0x0000000000657000-memory.dmp

Filesize
28KB

Download
memory/4884-8-0x0000000000650000-0x0000000000657000-memory.dmp

Filesize
28KB

Download